Skip to main content

Preparing for GDPR: Compliance and Risk Solutions

Published Date

On May 25, 2018, the European Union will officially redefine its regulations on data protection and privacy with the General Data Protection Regulation (GDPR), which updates and replaces the EU’s current Data Protection Directive. The new policy aims to streamline Europe’s data privacy laws and ensure that organizations better protect personally identifiable information (PII) like email and physical addresses or credit card and passport numbers. For organizations doing business in the EU (or with EU citizens), GDPR requires a new approach to data privacy, storage and processing. It also means businesses must increase their overall transparency while providing better protection for their client’s data.

Priorities for businesses

One near-term, high-level shift for businesses will be to embrace a model where the rights of their clients and customers come first. To comply with GDPR, businesses must institute data management policies that show they not only understand these rights but are actively taking steps to ensure the safety of client and customer data.

For businesses, there are six key points to keep in mind.

  1. Rights of the individual
    Individuals control their data and have the right to know who uses it — and what they’re doing with it.
  2. Right to access
    Upon request, organizations must be able to locate an individual’s PII, provide documentation of its processing and be able to report details to the individual client.
  3. Right to be forgotten
    Businesses must provide the means to permanently erase all PII when requested to do so.
  4. Data portability
    Under GDPR, individuals have the right to access their PII in a useable format and be able to transmit that data elsewhere.
  5. Privacy by design
    Beyond individual rights and access, GDPR also mandates that organizations boost their efforts to improve data privacy and security within their own systems and operations.
  6. Breach notification
    In the event of a breach, organizations are required to notify clients “without undue delay” after becoming aware of the breach.

The right tools can help

Given these mandates, it goes without saying that many organizations will be scrambling to align their operations with regulatory requirements. To start, organizations will need to be able to map, document, secure and reconfigure existing data stores. From there, they must take an enhanced approach to monitoring and managing data — and they will need to develop new workflows for identifying, securing and storing new data as it comes in.

To be successful, organizations must proactively roll-out comprehensive strategies, leverage technology like advanced analytics and prevention tools. Tools such as discovery analytics and machine learning can not only rapidly search, identify, categorize and tag relevant documents but also discover and analyze patterns and contextual themes — a boon for organizations setting out to consolidate PII and redesign their systems and workflows. However daunting, the drive towards GDPR compliance will likely create new opportunities for improving security and customer experience in the long run. Right now, while many organizations are simply trying to get moving as quickly as possible, find out how Conduent can help make sure you have the right tools in place.

Print